PRIVACY POLICY

1. Who We Are

ReCVme is operated by a solo founder based in India. For the purposes of data protection law, ReCVme is the data controller in respect of your personal data.

Data controller contact: privacy@recvme.com

Service website: https://recvme.com

2. Data We Collect

2.1 Account Information

• Email address
• Password (stored in hashed form — we never see your plaintext password)
• Account creation date and last login

2.2 Resume and Career Content

• Resume files you upload (PDF or DOCX format)
• Job description text you paste into the service
• Analysis results, optimised resume versions, and any saved outputs

2.3 Location and Device Information

• IP address (used to determine your approximate country for pricing and compliance purposes)
• Country-level location derived from IP address
• Browser type and version
• Device type (desktop, mobile, tablet)
• Operating system
• Pages visited, time spent, and interactions within the service (via Google Analytics)

2.4 Payment Information

We do not collect or store payment card details. Payment data is handled entirely by:

• Razorpay (for users in India) — they collect and process all payment information directly
• Stripe (for users outside India) — they collect and process all payment information directly

We receive only a transaction confirmation and anonymised payment reference from these processors.

2.5 Communications

• Emails you send to our support address
• Responses to any feedback requests we send

3. How We Use Your Data

3.1 Providing the Service

• Processing and analysing your resume against job descriptions
• Generating ATS compatibility scores, keyword reports, and optimisation suggestions
• Storing your resume files and analysis history in your account for re-use
• Managing your subscription, credits, and account settings

3.2 Location-Based Customisation

We use your IP address to determine your approximate country in order to:

• Display pricing in the currency relevant to your region (INR for India, GBP for UK, USD for all others)
• Apply region-specific legal disclosures where required
• Route payments to the appropriate payment processor

3.3 Analytics and Improvement

• Understanding how users interact with the service via Google Analytics
• Identifying errors, performance issues, and usability problems
• Informing product development decisions

3.4 Communications

• Sending transactional emails: receipts, password resets, account notifications
• Sending product update and changelog emails (you may unsubscribe at any time)
• Sending marketing and promotional emails (you may unsubscribe at any time via the link in every email)

4. Legal Basis for Processing

For users in the United Kingdom and European Economic Area, our legal bases under UK GDPR are:

• Contract: Processing necessary to provide the service you have requested (account management, resume analysis, payment processing)
• Legitimate interests: Analytics, product improvement, and fraud prevention, where these do not override your rights
• Consent: Marketing emails — you may withdraw consent at any time by unsubscribing
• Legal obligation: Retaining transaction records as required by applicable financial regulations

For users in India, processing is conducted in accordance with the Digital Personal Data Protection Act 2023 (DPDP Act 2023) on the basis of your consent given at account creation and, where applicable, legitimate uses permitted under that Act.

5. Data Storage and Retention

5.1 Where Your Data Is Stored

Your data is stored on secure servers. Resume files and account data are processed and stored in infrastructure provided by our hosting provider. Resume content submitted for AI analysis is transmitted to Google LLC's servers for processing by Google Gemini.

5.2 International Transfers

As a service based in India serving users globally, your data may be transferred to and processed in countries other than your own. For UK users, transfers outside the UK are conducted under appropriate safeguards including standard contractual clauses where required. For all users, Google LLC (our AI provider) processes data in accordance with Google's standard data processing terms.

5.3 Retention Periods

• Account information: Retained for as long as your account is active, plus 30 days after account deletion
• Resume files and analysis history: Retained in your account for as long as you choose to keep them. You may delete individual files or your entire history at any time from your account dashboard
• Transaction records: Retained for 7 years from the date of transaction in accordance with financial record-keeping obligations
• Analytics data: Retained in Google Analytics in accordance with Google's standard retention settings (26 months by default)
• Support emails: Retained for 2 years from the date of the last correspondence

6. Third-Party Data Processors

We share your data with the following third-party processors who act on our behalf:

6.1 Google LLC

• Service: Google Gemini (AI analysis) and Google Analytics (usage tracking)
• Data shared: Resume content and job description text (Gemini); anonymised usage data (Analytics)
• Purpose: AI-powered analysis and service improvement
• Privacy policy: policies.google.com/privacy

6.2 Razorpay

• Service: Payment processing for users in India
• Data shared: Payment information collected directly by Razorpay
• Privacy policy: razorpay.com/privacy

6.3 Stripe

• Service: Payment processing for users outside India
• Data shared: Payment information collected directly by Stripe
• Privacy policy: stripe.com/privacy

We do not sell your personal data to any third party. We do not share your resume content with employers, recruiters, or job boards.

7. Your Rights

Depending on your location, you have the following rights regarding your personal data:

7.1 Rights for All Users

• Access: Request a copy of the personal data we hold about you
• Correction: Ask us to correct inaccurate or incomplete data
• Deletion: Request deletion of your account and personal data
• Portability: Request your data in a machine-readable format
• Withdraw consent: Unsubscribe from marketing emails at any time

7.2 Additional Rights for UK Users (UK GDPR)

• Object to processing based on legitimate interests
• Restrict processing in certain circumstances
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

7.3 Additional Rights for Indian Users (DPDP Act 2023)

• Nominate a person to exercise rights on your behalf in the event of death or incapacity
• Lodge a complaint with the Data Protection Board of India once it is operational

To exercise any of these rights, contact us at privacy@recvme.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

8. Cookies and Tracking

We use the following cookies and tracking technologies:

• Essential cookies: Required for login sessions and account functionality. Cannot be disabled.
• Analytics cookies: Google Analytics uses cookies to collect anonymised usage data. You may opt out by installing the Google Analytics opt-out browser extension (tools.google.com/dlpage/gaoptout) or by adjusting your browser settings.

We do not use advertising cookies or third-party tracking pixels.

9. Data Security

We take reasonable technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of data at rest
• Password hashing using industry-standard algorithms
• Access controls limiting who can access user data within our systems

No method of data transmission or storage is 100% secure. In the event of a data breach that affects your rights and freedoms, we will notify you and relevant supervisory authorities as required by applicable law.

10. Children's Privacy

ReCVme is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at privacy@recvme.com and we will delete the data promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date and notify registered users via email. Continued use of the service after the effective date of any update constitutes acceptance of the revised policy.

12. Contact and Complaints

For all privacy-related queries, requests, or complaints:

• Email: privacy@recvme.com
• Website: https://recvme.com

If you are a UK user and are not satisfied with our response, you have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint